Analysis
-
max time kernel
150s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
06/06/2023, 01:37
General
-
Target
4c79b49a203edd1e36c026cb9751a805831703b01a0447361afcfe8db9707c82.exe
-
Size
687KB
-
MD5
a5a287e329d02dd5d3d7a33927f8c010
-
SHA1
de1c0df3338ae4a8e2bb2bb1555921dae6f1469c
-
SHA256
4c79b49a203edd1e36c026cb9751a805831703b01a0447361afcfe8db9707c82
-
SHA512
d7b55e27032f5253f6f440bc27b7ca805ac9e34fa07b3675b0e11061816928ff0ed628ffe63c7b4126f0a22471dd4ea4b48970fb05bb45f52d0531fef7edc49b
-
SSDEEP
12288:mE/nsY/Q69IYI9aysA2GD6WBZz/nGwayjP02KW5IneVS5BM7lPUj7PQixb7V:951bIR/2GpDz/n0yaWunR5BM7lgPQid
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c79b49a203edd1e36c026cb9751a805831703b01a0447361afcfe8db9707c82.exe"C:\Users\Admin\AppData\Local\Temp\4c79b49a203edd1e36c026cb9751a805831703b01a0447361afcfe8db9707c82.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
188KB
-
Filesize
3.0MB
-
Filesize
688KB
-
Filesize
40KB